OpenSIPS Vulnerability: Memory Corruption Risk in IP Address Handling
Summary
UBUNTU-CVE-2023-28099: OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Affects opensips versions 2.2.2-3build2 – 2.2.2-3build4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSIPS is a robust Session Initiation Protocol (SIP) server implementation that facilitates voice, video, and messaging communications over IP networks. It is designed to handle large volumes of SIP messages efficiently, making it a popular choice for service providers and enterprises. However, prior to versions 3.1.9 and 3.2.6, OpenSIPS had a critical vulnerability related to the handling of invalid IP address strings in the ds_is_in_list() function, which could lead to memory corruption and application crashes.
Vulnerability Detail
The vulnerability arises when the ds_is_in_list() function is called with an invalid IP address string, specifically when NULL is passed as an argument. This illegal input causes OpenSIPS to attempt to print a string from a random memory address, leading to potential crashes. Users who do not use the $si variable as the first parameter in this function may be affected to varying degrees, depending on whether the input is a valid IPv4 or IPv6 address. The vulnerability is classified with a CVSS score of 5.9, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to update to a patched version of OpenSIPS as mentioned above.
Conclusion
The OpenSIPS vulnerability related to the handling of invalid IP address strings poses a significant risk of memory corruption and application crashes. Users are strongly advised to update to the latest patched versions to ensure the security and stability of their systems.
See every vulnerability recorded for opensips →
FAQ
The vulnerability can lead to application crashes, which may disrupt services relying on OpenSIPS for communication.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Versions prior to 3.1.9 and 3.2.6 are vulnerable to this issue.
Yes, patches are available starting from versions 3.1.9 and 3.2.6.
While there are no workarounds, it is recommended to prioritize updating to a patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for opensips.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
